On 17 September 2026 Debian published DSA-6505-1, a bind9 update for Debian 13 (trixie) covering 14 vulnerabilities that ISC disclosed a day earlier. Debian says they may result in denial of service or cache poisoning. Debian 12 (bookworm), now maintained by the LTS team, received ten of these fixes on 27 October 2026 in DLA-4865-1.
This was the second large BIND round of the summer: DSA-6395-1 (22 July, trixie) and DLA-4725-1 (7 August, bookworm) fixed an earlier set of issues that Debian described as possible DNSSEC validation bypass, RPZ policy bypass, cache poisoning or denial of service. Trixie has since moved on again with DSA-6576-1 (21 October), so on trixie install the newest package, not just the one named here.
At a glance
| Item | Details |
|---|---|
| Source package | bind9 |
| Debian 13 (trixie) | Fixed in 1:9.20.29-1~deb13u1 (DSA-6505-1); later superseded by 1:9.20.30-1~deb13u1 |
| Debian 12 (bookworm) | Fixed in 1:9.18.49-1~deb12u3 (DLA-4865-1) for ten of the 14 |
| Previous round | DSA-6395-1 (trixie 1:9.20.26-1~deb13u1), DLA-4725-1 (bookworm 1:9.18.49-1~deb12u2) |
| Severity | High: ISC rates seven of the 14 High (CVSS 7.5), the rest Medium |
What the vulnerabilities are
ISC published one advisory per CVE. Grouped by effect:
Ways to make named exit (mostly High)
- CVE-2026-19666: a resolver using
dns64exits on a specifically malformed answer. - CVE-2026-19667: a negative answer of exactly 65,536 bytes from an attacker-controlled server leads to an abort.
- CVE-2026-80274: a valid wildcard answer with a signed NSEC3 proof followed by an unsigned NSEC at the same name triggers an exit.
- CVE-2026-76163: a TKEY query can crash a server whose
named.confhas no globaloptionsblock. - CVE-2026-77692: a crafted DNS-over-HTTPS request with an invalid SIG(0) record, followed by closing the connection, aborts
named. - CVE-2026-19662 (Medium): a use-after-free reachable with crafted, carefully timed answers from a DNSSEC-signed zone the attacker controls.
Resource exhaustion
- CVE-2026-81563 and CVE-2026-81736 (High): SVCB/HTTPS AliasMode records can leak cache references or cost disproportionate CPU time.
- CVE-2026-75029 and CVE-2026-19668 (Medium): repeated singleton records grow the negative cache, and large numbers of a particular invalid DNSSEC record cause excess work. ISC notes the default
max-records-per-typeandmax-types-per-namelimits help with the latter.
Integrity and validation (Medium)
- CVE-2026-19033: on a secondary zone protected by TSIG,
namedmay serve transferred IXFR data before the signed final message arrives, and does not roll back if it never does. - CVE-2026-77119 and CVE-2026-19941: unrelated NSEC3 or NSEC records may be accepted as DNSSEC proofs, which could let forged answers through or hide a wildcard.
- CVE-2026-78301: a malformed zone (for example received by zone transfer) can create a false zone cut.
ISC says it is not aware of active exploits, and none of these CVEs is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).
Are you affected?
dpkg-query -W -f='${Package} ${Version}\n' 'bind9*'
apt policy bind9
systemctl is-active namedTrixie systems older than 1:9.20.29-1~deb13u1 lack these fixes. Bookworm systems older than 1:9.18.49-1~deb12u3 lack the ten that DLA-4865-1 includes. DLA-4865-1 does not list CVE-2026-19668, CVE-2026-76163, CVE-2026-77119 or CVE-2026-77692, and the tracker still shows bookworm as vulnerable to them; ISC's own records list 76163 and 77692 as affecting BIND 9.20 and later only.
How to update
The same commands work on trixie and bookworm; LTS updates arrive through the normal bookworm-security repository:
sudo apt update
sudo apt install --only-upgrade bind9 bind9-libs bind9-utils bind9-dnsutils bind9-host
apt policy bind9On trixie this installs the newest build, which today is 1:9.20.30-1~deb13u1 and also contains the October fixes.
Restart or reboot?
No reboot. Restart BIND (the Debian unit is named) and check that it answers:
sudo systemctl restart named
named -v
dig @127.0.0.1 debian.org +shortSources
- security-tracker.debian.org/tracker/DSA-6505-1
- debian.org/security/2026/dsa-6505
- lists.debian.org/debian-security-announce/2026/msg00417.html
- security-tracker.debian.org/tracker/DLA-4865-1
- lists.debian.org/debian-lts-announce/2026/10/msg00059.html
- security-tracker.debian.org/tracker/DSA-6395-1
- lists.debian.org/debian-security-announce/2026/msg00306.html
- security-tracker.debian.org/tracker/DLA-4725-1
- lists.debian.org/debian-lts-announce/2026/08/msg00015.html
- security-tracker.debian.org/tracker/DSA-6576-1
- security-tracker.debian.org/tracker/bind9
- security-tracker.debian.org/tracker/CVE-2026-19668
- security-tracker.debian.org/tracker/CVE-2026-77692
- kb.isc.org/docs/aa-00913
- kb.isc.org/docs/cve-2026-19666
- kb.isc.org/docs/cve-2026-19033
- kb.isc.org/docs/cve-2026-76163
- kb.isc.org/docs/cve-2026-77692
- kb.isc.org/docs/cve-2026-19668
- cve.org/CVERecord?id=CVE-2026-19666
- cisa.gov/known-exploited-vulnerabilities-catalog
- wiki.debian.org/LTS
- debian.org/releases
Comments
0 total · 0 threads